Insecure Or Cleartext Authentication Detected Rule

maalyu1612 — Mon, 07 Mar 2022 11:25:43 GMT

Hi Team,

Rule "Insecure Or Cleartext Authentication Detected" detects says when Logon type "8" is detected in windows logs.

As per Splunk :
Detects authentication requests that transmit the password over the network as cleartext (unencrypted)

https://docs.splunksecurityessentials.com/content-detail/insecure_or_cleartext_authentication_detected/

As Per Windows:
The credentials do not traverse the network in plaintext (also called cleartext).

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624

Could you please let us know why this difference in description, This is creating some challenges in understanding the logs.

Can someone help on this.

Re: Insecure Or Cleartext Authentication Detected Rule

Stefanie — Mon, 07 Mar 2022 15:23:38 GMT

Logon Type 8 is generated when something was logged onto through the network using a cleartext password.

That last sentence from the Microsoft Documentation is a little confusing for me too. I had to read it a few times to understand what it was referencing.

During Network Logins, the Server that is being logged into has previously cashed those credentials.

During authentication, hashes are created and sent to the Server are used to compare to what the computer has cached.

This was done without utilizing SSL/TLS.

topic Re: Insecure Or Cleartext Authentication Detected Rule in Security

Insecure Or Cleartext Authentication Detected Rule

Re: Insecure Or Cleartext Authentication Detected Rule